Just want more clear on knowledgebase regarding tripwire .
Tripwire report can tell a file being modified with comparing with baseline generated by tripwire .
Also the report show who was the one last modified the file , I want to know “who” information that come from where and how ?
As Unix SA I can not recall any way UNIX system had this information restored in any file or inode .
Thank you .
![Confused Smilie](https://www.unix.com/images/smilies/confused.gif)